hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 14:23:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
This commit is contained in:
Slavomir
2020-05-11 12:37:14 +03:00
committed by GitHub
parent 836b8965e2
commit 5df81d3210
2 changed files with 14 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
ql/src/experimental/CWE-681/IncorrectNumericConversion.qhelp
View File

@@ -5,27 +5,27 @@
<overview>
<p>
If a numeric value string is parsed using <code>strconv.Atoi</code> into an int, and subsequently that int
is converted into another type of a lower bit size, the result can produce unexpected values.
is converted into another type of a smaller size, the result can produce unexpected values.
</p>
<p>
This also applie to the results of <code>strconv.ParseFloat</code>, <code>strconv.ParseInt</code>,
and <code>strconv.ParseUint</code> when the specified bit size is higher than the bit size of the
This also applies to the results of <code>strconv.ParseFloat</code>, <code>strconv.ParseInt</code>,
and <code>strconv.ParseUint</code> when the specified size is larger than the size of the
type that number is converted to.
</p>
</overview>
<recommendation>
<p>
If you need to parse numeric values with specific bit sizes, avoid <code>strconv.Atoi</code>, and, instead,
If you need to parse numeric values with specific bit sizes, avoid <code>strconv.Atoi</code>, and instead
use the functions specific to each type (<code>strconv.ParseFloat</code>, <code>strconv.ParseInt</code>,
<code>strconv.ParseUint</code>) that also allow to specify the wanted bit size.
</p>
<p>
When using those functions, be careful to not convert the result to another type with a lower bit size than
When using those functions, be careful to not convert the result to another type with a smaller bit size than
the bit size you specified when parsing the number.
</p>
<p>
If this is not possible, then add upper (and lower) bound checks specific to each type and
bit size (you can find the min and max value for each type in the `math` package).
bit size (you can find the minimum and maximum value for each type in the `math` package).
</p>
</recommendation>
<example>
@@ -35,13 +35,13 @@
</p>
<sample src="IncorrectNumericConversion.go"/>
<p>
The bounds are not checked, so this means that if the provided number is greater than max int32,
The bounds are not checked, so this means that if the provided number is greater than the maximum value of type <code>int32</code>,
the resulting value from the conversion will be different from the actual provided value.
</p>
<p>
To avoid unexpected values, you should either use the other functions provided by the <code>strconv</code>
package to parse the specific types and bit sizes; in this case, <code>strconv.ParseInt</code> as you
can see in <code>parseAllocateGood2</code> function; or check bounds as in <code>parseAllocateGood1</code>
package to parse the specific types and bit sizes as shown in the
<code>parseAllocateGood2</code> function; or check bounds as in the <code>parseAllocateGood1</code>
function.
</p>
<sample src="IncorrectNumericConversionGood.go"/>
@@ -53,7 +53,7 @@
</p>
<sample src="IncorrectNumericConversion.go"/>
<p>
If the provided number is greater than max int32, the resulting value from the conversion will be
If the provided number is greater than the maximum value of type <code>int32</code>, the resulting value from the conversion will be
different from the actual provided value.
</p>
<p>
@@ -70,4 +70,4 @@
mitre.org: <a href="https://cwe.mitre.org/data/definitions/190.html">CWE-190: Integer Overflow or Wraparound</a>.
</li>
</references>
</qhelp>
</qhelp>

5
ql/src/experimental/CWE-681/IncorrectNumericConversion.ql
View File

@@ -1,10 +1,11 @@
/**
* @name Incorrect Conversion between Numeric Types
* @name Incorrect conversion between numeric types
* @description Converting the result of strconv.Atoi (and other parsers from strconv package)
* to numeric types of lower bit size can produce unexpected values.
* to numeric types of smaller bit size can produce unexpected values.
* @kind path-problem
* @id go/incorrect-numeric-conversion
* @tags security
* external/cwe/cwe-190
* external/cwe/cwe-681
*/